CVE-2001-1471

prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.

• CWE-665

• http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.htmlBroken Link
• http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.htmlBroken Link
• http://www.kb.cert.org/vuls/id/920931Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/3167Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6944Third Party Advisory, VDB Entry
• http://archives.neohapsis.com/archives/bugtraq/2001-08/0123.htmlBroken Link
• http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2001-08/0087.htmlBroken Link
• http://www.kb.cert.org/vuls/id/920931Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/3167Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6944Third Party Advisory, VDB Entry

Published

Jul 31, 2001

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2001-1465SurfControl SuperScout only filters packets containing both …
• CVE-2001-1466Buffer overflow in VanDyke SecureCRT before 3.4.2, when usin…
• CVE-2001-1467mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 throu…
• CVE-2001-1468PHP remote file inclusion vulnerability in checklogin.php in…
• CVE-2001-1469The RC4 stream cipher as used by SSH1 allows remote attacker…
• CVE-2001-1470The IDEA cipher as implemented by SSH1 does not protect the …
• CVE-2001-1472SQL injection vulnerability in prefs.php in phpBB 1.4.0 and …
• CVE-2001-1473The SSH-1 protocol allows remote servers to conduct man-in-t…
• CVE-2001-1474SSH before 2.0 disables host key checking when connecting to…
• CVE-2001-1475SSH before 2.0, when using RC4 and password authentication, …
• CVE-2001-1476SSH before 2.0, with RC4 encryption and the "disallow NULL p…
• CVE-2001-1477The Domain gateway in BEA Tuxedo 7.1 does not perform author…